Skip to main content
Glama

Spend Guard

A spending guard for AI agents that pay for APIs in USDC.

An agent pays a paywall on Arc testnet. Spend Guard refuses a $0.40 price spike and a payment to an unknown address, then a $0.30 payment waits on the dashboard until a person clicks Approve.

A real run on Arc testnet with x402 exact (node demo/agent.js --arc-x402 --dashboard), trimmed and sped up: the guard refuses a 40x price spike and a swapped payout address before anything is signed, and a $0.30 payment goes out only after a person clicks Approve on the dashboard.

Agents are starting to pay per call over HTTP 402: the server answers 402 Payment Required with a price, the agent pays and gets the data (the x402 protocol). An agent that can pay can also be talked into paying: a prompt injection, a retry loop, or a paywall that raises its price or swaps its payout address. Spend Guard sits between the agent and its money. Every payment is checked against budgets, a payee allowlist and the endpoint's usual price, and anything unusual waits for a person to approve it. All of this happens before any USDC leaves and before any authorization is signed. It pays on Circle's Arc testnet by plain USDC transfer, by x402 exact (EIP-3009) and by Circle Gateway nanopayments, from a local key, and in NEAR on NEAR testnet. A rail for Circle developer-controlled wallets is tested offline only. Claude and other MCP clients can use it as an MCP server.

Status: testnet only, not audited. On npm as @vulinh1704/spend-guard and in the official MCP Registry as io.github.vulinh1704/spend-guard. MIT licensed.

Quickstart (1 minute, no keys)

You need git and Node 22.22.2 or later. No keys and no wallet: the payments are mocked, and nothing leaves your machine after the install.

git clone https://github.com/vulinh1704/spend-guard
cd spend-guard
npm ci
node demo/agent.js                       # a scripted agent against a demo paywall that turns bad
node demo/agent.js --dashboard           # the same run, paced, with the live page on http://localhost:4400

With --dashboard, open http://localhost:4400 while it runs. The $0.30 /report waits there for Approve or Deny, and is declined after 120 seconds without an answer. The page stays up until you press Ctrl+C. If 4400 is taken, the demo takes a free port and prints it; DASHBOARD_PORT picks another.

Related MCP server: halowerk-mcp

What it stops

The demo paywall behaves for a few calls and then turns bad. /quotes raises its price 40x, and /maps asks to be paid at a look-alike address. /report stays honest but costs more than the agent may pay without asking. This is the offline demo, node demo/agent.js:

✓ paid $0.01   /weather  {"city":"Hanoi","tempC":29,"sky":"clear"}
✓ paid $0.02   /news     {"headlines":["Stablecoin volume hits a record","New L2 opens its testnet"]}
✓ paid $0.01   /quotes   {"NEAR":2.5,"BCH":450}
✓ paid $0.01   /quotes   {"NEAR":2.5,"BCH":450}
✓ paid $0.01   /quotes   {"NEAR":2.5,"BCH":450}
✗ denied /quotes   $0.40 is 40x the usual $0.01 for 127.0.0.1:33955/quotes; $0.40 is above the $0.25 that needs your approval
✓ paid $0.015  /maps     {"route":"Hoan Kiem → My Dinh","km":11.2}
✓ paid $0.015  /maps     {"route":"Hoan Kiem → My Dinh","km":11.2}
✗ denied /maps     127.0.0.1:33955 asked to be paid at rnaps.paywall.testnet, which is not one of its known addresses
✓ paid $0.01   /weather  {"city":"Hanoi","tempC":29,"sky":"clear"}
  ? asks you: $0.30 is above the $0.25 that needs your approval → no
✗ declined /report   $0.30 is above the $0.25 that needs your approval

spent today $0.10 of $1.00; 3 payments stopped

The same run on Arc testnet with x402 exact (node demo/agent.js --arc-x402, 31 Oct 2026) paid in real test USDC. The agent only signed. The paywall settled each signature on chain and paid the gas, so the agent's balance fell by exactly the $0.10 it spent:

agent 0xBbc0B612C19beA521D2eA1Ad7dfEe91D23753244 · Arc testnet (USDC) · x402 v2 exact, EIP-3009
✓ paid $0.01   /weather  … https://testnet.arcscan.app/tx/0x92414aea1d896cd7ebd032c85ca32a84764d743931e61f4474a92f434a61fae3
✗ denied /maps     … asked to be paid at 0xF870cC7D7c258Cc856197fB6C3C819AD6Bb324b5, which is not one of its known addresses
agent wallet $17.999436 → $17.899436 USDC (-$0.10)

Rule

What it catches

A per-payment limit, a daily budget and a per-call cap for each service

overpriced calls; a loop's total stops at the daily budget

Payee allowlist per service

a paywall that starts asking to be paid somewhere else

Price spike against the endpoint's usual price

a sudden 5x, 40x, 1000x

Human approval above a threshold, or for an unknown service

large payments, a payment to a host the policy doesn't list, such as one an injected page pointed the agent to

One decision at a time (with a ledger file, across processes too)

parallel tool calls racing the daily budget

Every decision, paid or not, is recorded with its reasons. The rules and their exact messages are in docs/policy.md.

How it works

agent ── payingFetch(url) ──► paywall: 402 + offer (PAYMENT-REQUIRED)
              │
              ▼
            Guard ── policy: budgets, payees, usual price ── ledger
              │  └─ flagged? ask the person on the dashboard
              ▼
            Rail ── USDC transfer · EIP-3009 signature · Gateway authorization · Circle wallet
              │
payingFetch ──► paywall: PAYMENT-SIGNATURE ──► 200 + data + PAYMENT-RESPONSE (settlement)

The guard decides before a rail moves money or signs anything. A rail that signs uses the payee and amount the guard approved, never the paywall's own numbers, and it pins the chain and token it signs for. More in docs/architecture.md.

Rails

Rail

How the agent pays

Status

Arc USDC transfer (--arc)

ERC-20 transfer from the agent's key. The paywall checks the receipt's USDC Transfer event.

Works on Arc testnet, for example this payment.

x402 exact on Arc (--arc-x402)

Signs an EIP-3009 transferWithAuthorization for USDC. The paywall verifies and settles it, and pays the gas.

Works on Arc testnet. The demo paywall is its own settler.

Circle Gateway (--gateway)

Signs a Gateway authorization against USDC deposited once in Circle's Gateway Wallet. Circle settles the payments in batches.

Works on Arc testnet, with no Circle account or API key. One earlier run's payments landed in one batch transaction.

Circle Wallets

A Circle developer-controlled wallet transfers or signs, so no private key sits in the agent's process.

Tested offline against Circle's SDK. Not run against Circle yet, because it needs your Circle account (setup).

NEAR testnet (--near)

Native NEAR transfer.

Works on NEAR testnet.

Mock

Nothing moves.

Tests and the offline demo.

Bitcoin Cash, Concordium

Planned.

Details for each rail are in docs/rails.md.

x402 v2 and the exact scheme (EIP-3009)

payingFetch speaks x402 v2. It reads the offer from the PAYMENT-REQUIRED header, and still reads v1 JSON bodies. For an exact offer in USDC on Arc that names the token's EIP-712 domain, the agent signs a transferWithAuthorization and sends no transaction. The signature is the payment, so the guard decides first and counts it as spent when it is signed. Each signature is for the approved payee and amount only, has a fresh random nonce, and is valid for at most 120 seconds. Offers for another chain (the same key works on Arc mainnet), another token, or Permit2 and escrow flows are refused before anything is signed, with the reason.

node scripts/arc-testnet-wallet.js       # agent key and demo payees in .env; fund the agent at https://faucet.circle.com (Arc Testnet)
node scripts/arc-facilitator.js          # the demo paywall's settling key, topped up with a little test USDC for gas
node demo/agent.js --arc-x402 --dashboard

Circle Gateway nanopayments

The agent deposits USDC into Circle's Gateway Wallet once. After that each call is an off-chain authorization: no gas and no transaction per call, so a $0.01 call costs $0.01. Circle settles the payments on Arc in batches a few minutes later. A Gateway authorization stays valid for at least 7 days, so the guard decides before it is signed. The rail also signs nothing the deposit can't cover, counting what is signed but not settled yet.

node scripts/gateway-deposit.js 1        # approve and deposit 1 test USDC (two Arc transactions)
node demo/agent.js --gateway --dashboard # nanopayments to an x402 v2 seller that settles each one with Circle
node scripts/gateway-status.js           # Gateway balance, and each payment's batch transaction on Arc

Circle Wallets

With CircleWalletRail, Circle holds the key (MPC) and signs when asked. The agent's process has a testnet API key and an entity secret, but no private key, and Spend Guard still checks every payment before Circle is asked to send or sign. Circle's own controls (custody, screening, DENIED) still apply after the guard says yes. docs/circle-wallets.md explains the setup, which needs your own Circle developer account, and how the two layers fit together.

Use it from Claude or any MCP client

spend-guard mcp serves the guard over stdio and gives an MCP client three tools:

  • pay_and_fetch fetches a URL and pays its x402 paywall through the guard.

  • spending_status and spending_policy are read-only views of the budget, recent payments and the rules.

There is no tool to approve a payment or to change the policy. Payments the policy flags wait for you on the dashboard. They are declined after 55 seconds without an answer, and a call the client cancels never pays.

The config goes in .mcp.json (Claude Code, project scope) or claude_desktop_config.json (Claude Desktop). Cursor and other clients take the same mcpServers shape.

From npm. The default mock rail pays nothing, so this is a safe first try:

{
  "mcpServers": {
    "spend-guard": {
      "command": "npx",
      "args": ["-y", "@vulinh1704/spend-guard", "mcp"],
      "env": { "SPEND_GUARD_POLICY": "/abs/path/policy.json" }
    }
  }
}

The mock rail pretends to pay on near-testnet, so this policy must allow that network: list "networks": ["near-testnet"], or leave networks out and the server allows the networks of the rails it runs. A policy that lists only Arc networks leaves the mock rail nothing it may pay. To have something to pay, run the demo paywall from a clone, node demo/paid-api.js, and ask the agent to fetch http://localhost:4402/weather. demo/mcp-policy.json is a mock policy that knows its payees.

From a clone, and for the rails that pay. Node reads the keys from .env with --env-file, which npx can't pass on, so they stay out of the client's config:

{
  "mcpServers": {
    "spend-guard": {
      "command": "node",
      "args": ["--env-file=/abs/path/spend-guard/.env", "/abs/path/spend-guard/bin/spend-guard.js", "mcp"],
      "env": { "SPEND_GUARD_POLICY": "/abs/path/policy.json", "SPEND_GUARD_RAILS": "arc,gateway" }
    }
  }
}

Or in Claude Code: claude mcp add spend-guard -- npx -y @vulinh1704/spend-guard mcp, or from a clone claude mcp add spend-guard --env SPEND_GUARD_POLICY=/abs/path/policy.json --env SPEND_GUARD_RAILS=arc -- node --env-file=/abs/path/spend-guard/.env /abs/path/spend-guard/bin/spend-guard.js mcp

A policy.json for the arc,gateway config. Its networks are the ones those two rails pay on; with other rails, list theirs or leave networks out:

{ "networks": ["arc-testnet", "arc-testnet-gateway"], "dailyUsd": 1, "perPaymentUsd": 0.5, "askAboveUsd": 0.25, "spikeRatio": 5, "unknownService": "ask",
  "services": { "api.example.com": { "payTo": ["0xPayeeAddress"], "maxUsd": 0.1 } } }

Variable

Meaning

SPEND_GUARD_RAILS

mock (default, pays nothing), near, arc, gateway, or a comma list

SPEND_GUARD_POLICY

the policy file. Without one, every service is unknown, so every payment asks you. Without networks in it, the networks of the rails you run are allowed.

SPEND_GUARD_LEDGER

decisions file, read back on start, so a restart keeps today's spend. Servers on one file share one budget. Default ~/.spend-guard/ledger.jsonl; off keeps it in memory.

SPEND_GUARD_DASHBOARD_PORT

dashboard port on 127.0.0.1, default 4400; 0 picks a free one. If it is taken, a free one is used and named on stderr. off means no dashboard, and flagged payments are declined.

SPEND_GUARD_APPROVAL_TIMEOUT

seconds a payment waits for you (default 55). Raise it together with your client's tool timeout.

SPEND_GUARD_MOCK_NETWORK

the network the mock rail pretends to pay on (default near-testnet, which the demo paywall asks for)

ARC_PRIVATE_KEY

for arc and gateway. Testnet keys only.

NEAR_ACCOUNT_ID, NEAR_PRIVATE_KEY

for near. Testnet keys only.

Keys come from .env through --env-file and never go in the client's config. Run the paying agent without shell or browser tools: with them it could read .env, or press Approve itself.

Try it without a model: node scripts/mcp-demo.js (mock), or node scripts/mcp-demo.js --arc (real test USDC on Arc).

Approve on the dashboard

The dashboard during the offline demo: spent today $0.10 of $1.00, 8 paid, 2 stopped, and a $0.30 payment for /report waiting with Approve and Deny buttons

The dashboard is a live page on http://localhost:4400. It shows the budget, every decision with its reasons and a link to its transaction, and an Approve or Deny card with a countdown for each flagged payment. It listens on 127.0.0.1 only and answers to localhost names only, and an approval is accepted only from the page itself (same Origin, loopback peer, JSON body). It has light and dark themes and a responsive layout (it answers on localhost only, so approving from a phone is on the roadmap), and is checked with Mantis (scripts/check-dashboard.sh: 0 errors and 0 warnings on mobile and desktop, light and dark).

node demo/agent.js --dashboard           # the offline demo, paced for watching; /report waits for your answer

Install and test

npm ci
npm test                                 # 189 tests, offline: no network, no keys
node demo/agent.js                       # offline demo, mock payments

You need Node 22.22.2 or later, because near-api-js 7 does (Circle's SDK needs Node 22). The testnet demos read keys from .env, which is git-ignored, and the setup scripts write them there. Testnet tokens have no value. Never point the scripts at mainnet.

Demo

Needs

node demo/agent.js --arc

node scripts/arc-testnet-wallet.js, then test USDC from https://faucet.circle.com

node demo/agent.js --arc-x402

the above, plus node scripts/arc-facilitator.js

node demo/agent.js --gateway

the above, plus node scripts/gateway-deposit.js 1

node demo/agent.js --near

node scripts/near-testnet-account.js and node scripts/near-demo-payees.js

Add --dashboard to any of them to watch on the live page.

Use it as a library

import { Guard, payingFetch } from '@vulinh1704/spend-guard';
import { ArcRail } from '@vulinh1704/spend-guard/rails/arc';
import { GatewayRail } from '@vulinh1704/spend-guard/rails/gateway';

const guard = new Guard({
  policy: {
    networks: ['arc-testnet', 'arc-testnet-gateway'],
    dailyUsd: 5, perPaymentUsd: 1, askAboveUsd: 0.25, spikeRatio: 5, unknownService: 'ask',
    services: { 'api.example.com': { payTo: ['0xPayeeAddress'], maxUsd: 0.5 } },
  },
  rails: [new ArcRail({ privateKey: process.env.ARC_PRIVATE_KEY }), new GatewayRail({ privateKey: process.env.ARC_PRIVATE_KEY })],
  approve: async (intent, verdict) => askTheHuman(verdict.reasons), // never the model
});

const res = await payingFetch(guard, 'https://api.example.com/data'); // pays a 402 through the guard

payingFetch throws GuardRefused with the reasons when the guard says no. Approvals is the queue the dashboard and the MCP server use for approve. Install it with npm install @vulinh1704/spend-guard (Node 22.22.2 or later).

Docs

Roadmap

Not built yet. This is the order I plan to build them in:

  1. Circle Wallets live. Run the rail against Circle's testnet with a developer account, then offer it in the MCP server, so an agent pays from a wallet whose key never leaves Circle.

  2. Settle through Circle instead of my own settler. Use Circle's facilitator for x402 exact on Arc where it is available, and Gateway on more chains from the same deposit.

  3. Close the known gaps. Count gas in the budgets, keep Gateway's unsettled count across restarts, and accept smart-wallet payers (ERC-1271), such as Circle SCA wallets, whose gas Circle's Gas Station can sponsor.

  4. A hosted policy and approvals page for teams.

  5. Mainnet, only after an external review of the guard and the rails.

License

MIT

Available Tools

3 tools
pay_and_fetchFetch, paying the paywall if there is oneA
Destructive

Fetch a URL and, if it answers HTTP 402 (an x402 paywall), pay it through the user's Spend Guard. The payment goes out only if it fits the user's budget, goes to an address the service is known to use and is not a price spike; larger payments and unknown services wait for the user to approve them on the dashboard. Returns the HTTP status, what was paid (amount, payee, transaction) and the response body. Redirects are not followed. A refused payment is final: tell the user what was refused and why, and do not try to pay another way.

NameRequiredDescriptionDefault
urlYesThe http(s) URL to fetch.
bodyNoRequest body, for POST, PUT and PATCH.
methodNoDefault GET.
headersNoExtra request headers, e.g. {"accept": "application/json"}. Payment, cookie and origin headers are set by the guard or dropped.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare this is an open-world, non-idempotent, destructive (spending) operation, and the description adds substantial context beyond that: the budget/payee/price-spike gating logic, the human-approval escalation, the finality of a refused payment, and the no-redirect behavior. It also describes the return payload, which matters since there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the 402-payment mechanic are front-loaded, followed by the decision rules, then the return shape and constraints. Every sentence carries distinct operational information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema, the description covers the full behavioral picture an agent needs: what triggers payment, when a human must approve, what is returned, and how to handle a refusal. Annotations handle the safety profile and the schema handles parameters, so nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter (url, method, body, headers) is documented in the schema, including the guard dropping payment/cookie/origin headers. The description adds essentially no per-parameter detail, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (fetch) and resource (URL) and adds the distinguishing twist: it transparently handles HTTP 402 paywalls via the Spend Guard. This is clearly separable from the spending_status and spending_policy siblings, which report on or configure spending rather than performing a fetch-and-pay.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit conditions for when payment proceeds automatically (within budget, known payee, no price spike) versus when it waits for dashboard approval (larger payments, unknown services), and states that redirects are not followed and a refusal must not be worked around. It does not name the sibling tools as alternatives or say when to prefer spending_status/policy first, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

spending_policySpending rulesA
Read-only

The rules the guard enforces: the networks it can pay on, the daily and per-payment limits, the amount above which the user approves, the price-spike ratio, and the known services with the addresses they may be paid at. Read only: only the user can change them.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered; the description adds that the rules are user-mutable only, meaning there is no write path here and the agent should not look for one. It also discloses the field-level shape of the returned configuration, which annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the resource definition, followed by the read-only constraint. The middle enumeration is dense but each item earns its place by telling the agent what data is available without an output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters and no output schema, the description carries the burden of describing the return shape, and it does so by listing the rule categories an agent can expect. What is missing is only a hint about when to consult it versus spending_status.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; there is nothing for the description to disambiguate. It correctly spends no words on arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific noun-resource ('the rules the guard enforces') and then enumerates exactly what those rules cover: payable networks, daily/per-payment limits, approval threshold, price-spike ratio, and allowed services/addresses. An agent can tell this is a configuration/policy read rather than a live status or a payment action, though it never names the siblings it differs from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the content list hints the agent should read this before deciding whether a payment is permissible, but there is no explicit 'use this when...' clause and no discussion of spending_status or pay_and_fetch as alternatives. 'Read only: only the user can change them' is a constraint, not routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

spending_statusSpending so farA
Read-only

What has been spent today against the user's daily budget, payments waiting for the user's approval, and the latest payments with their outcome (paid, denied, declined or failed) and every reason. Check it before a series of paid calls.

NameRequiredDescriptionDefault
limitNoHow many recent payments to list. Default 10.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, so the safety profile is covered; the description adds substantive value by enumerating exactly what content comes back (budget consumption, pending approvals, per-payment outcome and reasons). Remainder: no mention of how much data defaults to or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with what is returned and closing with the when-to-call cue. Slightly dense enumeration but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so the description must explain return content – and it does, itemizing the three data groups and payment outcome values. Sufficient to call confidently; a note on default result size (implied by schema) or freshness would complete it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single optional param with 100% schema coverage (limit, default 10, max 50). The description says nothing the schema doesn't already state, so the baseline 3 holds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific resource and clear breakdown of the three things returned: today's spend against daily budget, pending approvals, and latest payment outcomes with reasons. Distinct from siblings pay_and_fetch (action) and spending_policy (rules) without needing to open a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete trigger: 'Check it before a series of paid calls.' Doesn't explicitly contrast with spending_policy or say when not to call, but the pre-flight guidance is actionable and clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedpay_and_fetch
    • First observedspending_policy
    • First observedspending_status

TDQS

A4/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: one performs fetch-and-pay, one reports spending state, and one describes policy. There is no overlap in action or resource, so an agent can easily pick the right tool.

Naming Consistency3/5

Names are readable but use mixed conventions: pay_and_fetch is verb_and_verb while spending_status and spending_policy are noun phrases. The shared spending_ prefix helps, but the set does not follow a predictable verb_noun pattern.

Tool Count4/5

Three tools is slightly thin but well matched to a narrow spend-guard purpose. Each tool earns its place, though a few more operations could be reasonable.

Completeness4/5

The surface covers the core lifecycle: paying via fetch, checking budget/status, and reading enforced policy. Minor gaps exist around explicit history or approval workflows, but these are intentionally left to the user dashboard.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    F
    maintenance
    Enables MCP clients to access all endpoints of an x402 gateway by paying real-time microtransactions (USDC on Base) per API call, with automatic tool discovery and spend guardrails.
    23
    52 npm
    MIT
  • A
    license
    A
    quality
    F
    maintenance
    Provides access to 70 paid APIs as MCP tools with per-call and session budgets, paying via x402/USDC on Base without requiring an account or login. Includes a built-in allowlist of hosts and safe defaults to prevent unintended payments.
    14
    72 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Lets MCP clients discover x402 APIs, pay for calls from a local non-custodial wallet, and inspect balances and payment receipts.
    11
    Apache 2.0